Accept Android app origin in the other two WebAuthn ceremonies too

gunet · Nov 26, 2024 · 58f473f · 58f473f
1 parent 82bd83f
commit 58f473f
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/src/routers/user.router.ts b/src/routers/user.router.ts
@@ -273,7 +273,10 @@ noAuthUserController.post('/login-webauthn-finish', async (req: Request, res: Re
 			clientExtensionResults: credential.clientExtensionResults,
 		},
 		expectedChallenge: base64url.encode(challenge.challenge),
-		expectedOrigin: config.webauthn.origin,
+		expectedOrigin: [
+			config.webauthn.origin,
+			"android:apk-key-hash:DEvegOak87MZWC6pGyDa3hqKnNwptRv8iTeQssaM2ME", // TODO: Extract to config?
+		],
 		expectedRPID: config.webauthn.rp.id,
 		requireUserVerification: true,
 		authenticator: {
@@ -416,7 +419,10 @@ userController.post('/webauthn/register-finish', async (req: Request, res: Respo
 			clientExtensionResults: credential.clientExtensionResults,
 		},
 		expectedChallenge: base64url.encode(challenge.challenge),
-		expectedOrigin: config.webauthn.origin,
+		expectedOrigin: [
+			config.webauthn.origin,
+			"android:apk-key-hash:DEvegOak87MZWC6pGyDa3hqKnNwptRv8iTeQssaM2ME", // TODO: Extract to config?
+		],
 		expectedRPID: config.webauthn.rp.id,
 	});